Completely separate old and new OpenSSH key handling code.

[PuTTY.git] / cmdgen.c

diff --git a/cmdgen.c b/cmdgen.c
index c15c01dd34bab2e82bd6529b78387344bbd93980..ea60c25f7dbdc82ad2defa6c4049c8ae05f71583 100644 (file)
--- a/cmdgen.c
+++ b/cmdgen.c
@@ -160,6 +160,10 @@ void help(void)
            "  -O    specify output type:\n"
            "           private             output PuTTY private key format\n"
            "           private-openssh     export OpenSSH private key\n"
+           "           private-openssh-pem export OpenSSH private key "
+                                             "(force old PEM format)\n"
+           "           private-openssh-new export OpenSSH private key "
+                                             "(force new format)\n"
            "           private-sshcom      export ssh.com private key\n"
            "           public              standard / ssh.com public key\n"
            "           public-openssh      OpenSSH public key\n"
@@ -265,9 +269,10 @@ int main(int argc, char **argv)
 {
     char *infile = NULL;
     Filename *infilename = NULL, *outfilename = NULL;
-    enum { NOKEYGEN, RSA1, RSA2, DSA } keytype = NOKEYGEN;    
+    enum { NOKEYGEN, RSA1, RSA2, DSA, ECDSA } keytype = NOKEYGEN;
     char *outfile = NULL, *outfiletmp = NULL;
-    enum { PRIVATE, PUBLIC, PUBLICO, FP, OPENSSH, SSHCOM } outtype = PRIVATE;
+    enum { PRIVATE, PUBLIC, PUBLICO, FP, OPENSSH_PEM,
+           OPENSSH_NEW, SSHCOM } outtype = PRIVATE;
     int bits = 2048;
     char *comment = NULL, *origcomment = NULL;
     int change_passphrase = FALSE;
@@ -437,6 +442,8 @@ int main(int argc, char **argv)
                            keytype = RSA1, sshver = 1;
                        else if (!strcmp(p, "dsa") || !strcmp(p, "dss"))
                            keytype = DSA, sshver = 2;
+                        else if (!strcmp(p, "ecdsa"))
+                            keytype = ECDSA, sshver = 2;
                        else {
                            fprintf(stderr,
                                    "puttygen: unknown key type `%s'\n", p);
@@ -458,8 +465,11 @@ int main(int argc, char **argv)
                            outtype = PRIVATE;
                        else if (!strcmp(p, "fingerprint"))
                            outtype = FP;
-                       else if (!strcmp(p, "private-openssh"))
-                           outtype = OPENSSH, sshver = 2;
+                       else if (!strcmp(p, "private-openssh") ||
+                                 !strcmp(p, "private-openssh-pem"))
+                           outtype = OPENSSH_PEM, sshver = 2;
+                       else if (!strcmp(p, "private-openssh-new"))
+                           outtype = OPENSSH_NEW, sshver = 2;
                        else if (!strcmp(p, "private-sshcom"))
                            outtype = SSHCOM, sshver = 2;
                        else {
@@ -497,6 +507,11 @@ int main(int argc, char **argv)
        }
     }
 
+    if (keytype == ECDSA && (bits != 256 && bits != 384 && bits != 521)) {
+        fprintf(stderr, "puttygen: invalid bits for ECDSA, choose 256, 384 or 521\n");
+        errs = TRUE;
+    }
+
     if (errs)
        return 1;
 
@@ -529,7 +544,8 @@ int main(int argc, char **argv)
      * We must save the private part when generating a new key.
      */
     if (keytype != NOKEYGEN &&
-       (outtype != PRIVATE && outtype != OPENSSH && outtype != SSHCOM)) {
+       (outtype != PRIVATE && outtype != OPENSSH_PEM &&
+         outtype != OPENSSH_NEW && outtype != SSHCOM)) {
        fprintf(stderr, "puttygen: this would generate a new key but "
                "discard the private part\n");
        return 1;
@@ -583,7 +599,8 @@ int main(int argc, char **argv)
            break;
 
          case SSH_KEYTYPE_SSH2:
-         case SSH_KEYTYPE_OPENSSH:
+         case SSH_KEYTYPE_OPENSSH_PEM:
+         case SSH_KEYTYPE_OPENSSH_NEW:
          case SSH_KEYTYPE_SSHCOM:
            if (sshver == 1) {
                fprintf(stderr, "puttygen: conversion from SSH-2 to SSH-1 keys"
@@ -607,7 +624,8 @@ int main(int argc, char **argv)
      */
     if ((intype == SSH_KEYTYPE_SSH1 && outtype == PRIVATE) ||
        (intype == SSH_KEYTYPE_SSH2 && outtype == PRIVATE) ||
-       (intype == SSH_KEYTYPE_OPENSSH && outtype == OPENSSH) ||
+       (intype == SSH_KEYTYPE_OPENSSH_PEM && outtype == OPENSSH_PEM) ||
+       (intype == SSH_KEYTYPE_OPENSSH_NEW && outtype == OPENSSH_NEW) ||
        (intype == SSH_KEYTYPE_SSHCOM && outtype == SSHCOM)) {
        if (!outfile) {
            outfile = infile;
@@ -625,7 +643,8 @@ int main(int argc, char **argv)
             * Bomb out rather than automatically choosing to write
             * a private key file to stdout.
             */
-           if (outtype==PRIVATE || outtype==OPENSSH || outtype==SSHCOM) {
+           if (outtype == PRIVATE || outtype == OPENSSH_PEM ||
+                outtype == OPENSSH_NEW || outtype == SSHCOM) {
                fprintf(stderr, "puttygen: need to specify an output file\n");
                return 1;
            }
@@ -638,8 +657,11 @@ int main(int argc, char **argv)
      * out a private key format, or (b) the entire input key file
      * is encrypted.
      */
-    if (outtype == PRIVATE || outtype == OPENSSH || outtype == SSHCOM ||
-       intype == SSH_KEYTYPE_OPENSSH || intype == SSH_KEYTYPE_SSHCOM)
+    if (outtype == PRIVATE || outtype == OPENSSH_PEM ||
+        outtype == OPENSSH_NEW || outtype == SSHCOM ||
+       intype == SSH_KEYTYPE_OPENSSH_PEM ||
+       intype == SSH_KEYTYPE_OPENSSH_NEW ||
+        intype == SSH_KEYTYPE_SSHCOM)
        load_encrypted = TRUE;
     else
        load_encrypted = FALSE;
@@ -663,6 +685,8 @@ int main(int argc, char **argv)
        tm = ltime();
        if (keytype == DSA)
            strftime(default_comment, 30, "dsa-key-%Y%m%d", &tm);
+        else if (keytype == ECDSA)
+            strftime(default_comment, 30, "ecdsa-key-%Y%m%d", &tm);
        else
            strftime(default_comment, 30, "rsa-key-%Y%m%d", &tm);
 
@@ -684,6 +708,19 @@ int main(int argc, char **argv)
            ssh2key->data = dsskey;
            ssh2key->alg = &ssh_dss;
            ssh1key = NULL;
+        } else if (keytype == ECDSA) {
+            struct ec_key *ec = snew(struct ec_key);
+            ec_generate(ec, bits, progressfn, &prog);
+            ssh2key = snew(struct ssh2_userkey);
+            ssh2key->data = ec;
+            if (bits == 256) {
+                ssh2key->alg = &ssh_ecdsa_nistp256;
+            } else if (bits == 384) {
+                ssh2key->alg = &ssh_ecdsa_nistp384;
+            } else {
+                ssh2key->alg = &ssh_ecdsa_nistp521;
+            }
+            ssh1key = NULL;
        } else {
            struct RSAKey *rsakey = snew(struct RSAKey);
            rsa_generate(rsakey, bits, progressfn, &prog);
@@ -809,7 +846,8 @@ int main(int argc, char **argv)
            }
            break;
 
-         case SSH_KEYTYPE_OPENSSH:
+         case SSH_KEYTYPE_OPENSSH_PEM:
+         case SSH_KEYTYPE_OPENSSH_NEW:
          case SSH_KEYTYPE_SSHCOM:
            ssh2key = import_ssh2(infilename, intype, passphrase, &error);
            if (ssh2key) {
@@ -898,7 +936,7 @@ int main(int argc, char **argv)
        outfilename = filename_from_str(outfile ? outfile : "");
 
     switch (outtype) {
-       int ret;
+       int ret, real_outtype;
 
       case PRIVATE:
        if (sshver == 1) {
@@ -1030,13 +1068,27 @@ int main(int argc, char **argv)
        }
        break;
        
-      case OPENSSH:
+      case OPENSSH_PEM:
+      case OPENSSH_NEW:
       case SSHCOM:
        assert(sshver == 2);
        assert(ssh2key);
        random_ref(); /* both foreign key types require randomness,
                        * for IV or padding */
-       ret = export_ssh2(outfilename, outtype, ssh2key, passphrase);
+        switch (outtype) {
+          case OPENSSH_PEM:
+            real_outtype = SSH_KEYTYPE_OPENSSH_PEM;
+            break;
+          case OPENSSH_NEW:
+            real_outtype = SSH_KEYTYPE_OPENSSH_NEW;
+            break;
+          case SSHCOM:
+            real_outtype = SSH_KEYTYPE_SSHCOM;
+            break;
+          default:
+            assert(0 && "control flow goof");
+        }
+       ret = export_ssh2(outfilename, real_outtype, ssh2key, passphrase);
        if (!ret) {
            fprintf(stderr, "puttygen: unable to export key\n");
            return 1;